New N-able N-central Zero-Days “4EverAble2Shell” and “Agent2Shell” Bypass Able2Shell Hotfix; Exploitation Attempts Already Seen
N-able says it is investigating a new public disclosure of more vulnerabilities in on-premise N-central servers running version 2026.4.1 HF2. That is the hotfix it released only days ago to fix the Able2Shell vulnerabilities. Public proof-of-concept (PoC) exploits are available, and threat intelligence firms have already seen targeted probing within hours of their release.
Background: Able2Shell
Earlier this week, independent security researcher Sean Bales disclosed several security flaws in N-central, tracked together as Able2Shell. On November 10, 2026, N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26) to fix them.
The new vulnerabilities
Bales has now published two more attack chains, along with PoC exploits that he says work against the patched build 2026.4.1.26:
- 4EverAble2Shell: Enables unauthenticated remote code execution with root privileges on N-central servers.
- Agent2Shell: Chains more than 10 zero-day vulnerabilities to run commands as
NT AUTHORITY\SYSTEMon managed Windows agents. The attacker needs to know the target appliance ID.
Agent2Shell is particularly concerning in MSP environments. A single compromised N-central server could give attackers SYSTEM-level command execution across many downstream customer endpoints.
N-able’s response
N-able says its initial review shows the server issue depends on a non-default configuration: the Legacy API is turned on and exposed to the public internet. The Legacy API is off by default and not recommended. N-able is urging customers to disable it immediately if they haven’t already.
The issue affects these services:
- N-central On-premise (Americas)
- N-central On-premise (APAC)
- N-central On-premise (Europe)
Hosted N-central environments are not affected.
Exploitation attempts in the wild
Ryan Dewhurst, founder and CEO of Previdian, said his company saw targeted N-central probing for 4EverAble2Shell within hours of the PoC release. In the observed attack chain, threat actors:
- Attempted initial code execution through CVE-2026-90436 (CVSS 9.8), a recently disclosed Apache Axis flaw that was patched on November 6, 2026.
- Attempted to escalate to root privileges using 4EverAble2Shell.
- Attempted to download and run a shell script from the attacker’s server using
curl.
According to Dewhurst, this is the first documented exploitation attempt targeting CVE-2026-90436. There is no evidence of successful exploitation so far. watchTowr also reported seeing 4EverAble2Shell probes targeting N-central builds with the Legacy API enabled.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPv4 | 157.20.241[.]16 | Source of 4EverAble2Shell probing and host of the shell script downloaded with curl (observed by Previdian) |
| CVE | CVE-2026-90436 | Apache Axis flaw used for initial code execution attempts |
Recommendations
- Disable the Legacy API right away on all on-premise N-central servers, and make sure it is not exposed to the internet.
- Make sure you’re running build 2026.4.1.26 to fix the original Able2Shell flaws. Note that it does not fix the new issues, so watch N-able’s advisories for a further fix.
- Restrict internet exposure of N-central servers; where possible, put them behind a VPN or allow-list access.
- Block and hunt for 157.20.241[.]16 in firewall, proxy, and EDR logs, including outbound
curlconnections from N-central servers. - Review N-central servers for unexpected processes, new files, shell scripts, or cron jobs, and check Apache Axis-related logs for exploitation attempts.
- Monitor managed Windows agents for unusual commands running as
NT AUTHORITY\SYSTEMthat come from the N-central agent. - MSPs should notify their customers and be ready for incident response, given the possible downstream impact.
We will update this post as N-able releases further fixes or if successful exploitation is confirmed.
